topic Re: syslog RFC 3164 (old) and RFC 5424 (new). in Firewall and Security Management

syslog RFC 3164 (old) and RFC 5424 (new).

AkosBakos — Mon, 30 Jan 2023 13:03:46 GMT

Hi CheckMates,

I read that, both syslog formats are supported ins R81.10

https://sc1.checkpoint.com/documents/R81.10/WebAdminGuides/EN/CP_R81.10_LoggingAndMonitoring_AdminGuide/Topics-LMG/Working-with-Syslog-Servers.htm?Highlight=working

How can I switch between syslog formats (RFC 3164 (old) and RFC 5424 (new)?

Akos

Re: syslog RFC 3164 (old) and RFC 5424 (new).

Chris_Atkinson — Mon, 30 Jan 2023 13:33:56 GMT

Is there a specific format / parsing issue or similar that you are trying to address?

Typically LogExporter is the most flexible approach per sk122323.

Re: syslog RFC 3164 (old) and RFC 5424 (new).

AkosBakos — Mon, 30 Jan 2023 13:44:08 GMT

Hi Chris,

Exactly, the receiver side reported that, they can't parse the new format. Therefore I would like to swich the format to the older one.

After I switched it I will be able to point out, the error is on the receiver side.

That is my motivation.

Akos

Re: syslog RFC 3164 (old) and RFC 5424 (new).

PhoneBoy — Mon, 30 Jan 2023 13:55:21 GMT

You realize this method only gives you limited Firewall-only logs, correct? (Nothing for other blades)
Log Exporter would be a much better way to export logs and offers other formats to export the logs.

Re: syslog RFC 3164 (old) and RFC 5424 (new).

AkosBakos — Mon, 30 Jan 2023 13:59:06 GMT

Hi PhoneBoy,

To clarify the situation. I use cp_clog_export for exporting the logs.

Akos

Re: syslog RFC 3164 (old) and RFC 5424 (new).

PhoneBoy — Mon, 30 Jan 2023 19:29:37 GMT

I assume you mean cp_log_export, which is Log Exporter.
However, what you provided a link to is not relevant to Log Exporter, but to a feature that allows sending specific traffic logs as syslog from the gateway itself (not the management).
Use the "format" option in Log Exporter to determine the format to send to the remote syslog server, which supports:

generic
cef
json
leef
logrhythm
rsa
splunk
syslog

Parsing is the responsibility of the remote end.

Re: syslog RFC 3164 (old) and RFC 5424 (new).

AkosBakos — Mon, 30 Jan 2023 19:36:05 GMT

Hi PhoneBoy,

Yes, I meant Log Exporter.

In the format settings

Is the deafult syslog format RFC 5424 format? If yes, can we change it somehow?

Akos

Re: syslog RFC 3164 (old) and RFC 5424 (new).

PhoneBoy — Mon, 30 Jan 2023 19:41:09 GMT

I presume it is the default format, yes.
I don't believe you can change it.
What is the precise syslog server in use on the other end?
What is the precise CLI command you use to configure Log Exporter (or a screenshot of what's in SmartConsole)?

Re: syslog RFC 3164 (old) and RFC 5424 (new).

AkosBakos — Mon, 30 Jan 2023 19:53:52 GMT

Hi Phoneboy,

The format part of the CLI command is "syslog"

The receiver syslog server's brand is Logness. It is an unique development. I do not hav the information, what is the base of this solution.

Akos

Re: syslog RFC 3164 (old) and RFC 5424 (new).

PhoneBoy — Mon, 30 Jan 2023 20:12:22 GMT

You might try "generic" and see if that provides a better result.

Re: syslog RFC 3164 (old) and RFC 5424 (new).

AkosBakos — Wed, 01 Feb 2023 08:09:54 GMT

Hi,

Now it is much better than earlier was. Based on this, we asked the customer to contact the SIEM support to clarify this issue on the other side.

We can't change more things in log exporter.

Akos

Re: syslog RFC 3164 (old) and RFC 5424 (new).

jennyado — Fri, 23 Jan 2026 21:32:54 GMT

I have the same question. Do you know if selecting the syslog format automatically applies RFC 5424 instead of RFC 3164? If the default is the old RFC 3164, how can I change it to RFC 5424?